{
	"id": "b30a46ea-d678-40df-8b19-43416ccc3db4",
	"created_at": "2026-05-07T02:43:24.655026Z",
	"updated_at": "2026-05-07T02:44:10.955164Z",
	"deleted_at": null,
	"sha1_hash": "d00ce0cea066e57ec4a1ad5dda1abc535592d7c1",
	"title": "Beyond BITTER: MENA Civil Society Targeted in Hack-For-Hire Operation Linke",
	"llm_title": "",
	"authors": "",
	"file_creation_date": "0001-01-01T00:00:00Z",
	"file_modification_date": "0001-01-01T00:00:00Z",
	"file_size": 85929,
	"plain_text": "Beyond BITTER: MENA Civil Society Targeted in Hack-For-Hire\r\nOperation Linke\r\nBy Lookout\r\nPublished: 2026-04-08 · Archived: 2026-05-07 02:15:59 UTC\r\ntreasuresland[.]cc clubline[.]cc totpro[.]app\r\nstore[.]totpro[.]app static[.]totpro[.]app download[.]totpro[.]app\r\nimtok[.]io device-update[.]imtok[.]io static[.]newupdate[.]app\r\nstore[.]newupdate[.]app newupdate[.]app download[.]newupdate[.]app\r\nxk[.]linedata[.]sbs test-sale[.]linedata[.]sbs mail[.]linedata[.]sbs\r\nlinedata[.]sbs idms-manage-on[.]linedata[.]sbs manage-facetimeidms[.]datastatistics[.]nl\r\nmail[.]datastatistics[.]nl idms-mng-rec[.]datastatistics[.]nl datastatistics[.]nl\r\nd9[.]datastatistics[.]nl concejwkfih9ghksjdfsdf[.]datastatistics[.]nl nb[.]com-ar[.]nl\r\nmng-info-doc-mf[.]com-ar[.]nl mng-en[.]com-ar[.]nl mail[.]com-ar[.]nl\r\njoin-call-ms-team[.]com-ar[.]nl isupport[.]com-ar[.]nl imange[.]com-ar[.]nl\r\nimanage[.]com-ar[.]nl drive-mofa-gov-bh[.]com-ar[.]nl com-ar[.]nl\r\nqq[.]mfadata[.]cc ms-call-manage[.]mfadata[.]cc mng-rec-mofa-govbh[.]mfadata[.]cc\r\nmfadata[.]cc mail[.]mfadata[.]cc id-mng-en[.]mfadata[.]cc\r\ncondfkdsf34ihfsdf[.]mfadata[.]cc\r\nupdate-release-version-for-android[.]ai-ae[.]io\r\ntotok-pro[.]ai-ae[.]io\r\ntest[.]ai-ae[.]io\r\ntemple-university-zoom-meeting[.]ai-ae[.]io\r\npro-myvpn[.]ai-ae[.]io\r\nmail[.]ai-ae[.]io join-secure-call[.]ai-ae[.]io join-cll-secure-wt[.]ai-ae[.]io\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 1 of 26\n\njn[.]ai-ae[.]io download[.]ai-ae[.]io download-botim-pro[.]ai-ae[.]io\r\nbotim[.]ai-ae[.]io ai-ae[.]io mail[.]id-us[.]cc\r\nid-us[.]cc apple[.]id-us[.]cc id-ac[.]us\r\nre-acc[.]cc test[.]signal-help[.]org signal-help[.]org\r\nmail[.]signal-help[.]org connect-signal[.]id-ar[.]ca account-validation-required[.]ct[.]ws\r\ntest[.]en-info[.]live stg[.]en-info[.]live staging[.]en-info[.]live\r\nsecure[.]en-info[.]live qurcxlny[.]en-info[.]live qa[.]en-info[.]live\r\nnew[.]en-info[.]live marketing[.]en-info[.]live m[.]en-info[.]live\r\nlink-signal-org[.]en-info[.]live landings[.]en-info[.]live join-teams[.]en-info[.]live\r\nggdkowww[.]testh[.]en-info[.]live dev[.]en-info[.]live demo[.]en-info[.]live\r\nc7a4603c-4442-4001-967e-70797b1143e1[.]en-info[.]live\r\nassets[.]en-info[.]live app[.]en-info[.]live\r\napi[.]en-info[.]live antrxyke[.]en-info[.]live admin[.]en-info[.]live\r\n978c6bd2-fcba-4758-917e-dc6298b61632[.]en-info[.]live3e8ce93b-34eb-4d31-9243-\r\n4481ffb98cd3[.]en-info[.]live\r\nweb[.]en-info[.]live\r\nvrsompac[.]en-info[.]live v2[.]en-info[.]live v1[.]en-info[.]live\r\nuat[.]en-info[.]live tgyoewww[.]rev-auth-num[.]en-info[.]live wegrow[.]ecomservices[.]cc\r\nmail[.]ecomservices[.]cc jfhwedkas[.]ecomservices[.]cc ecomservices[.]cc\r\ntest[.]id-ar[.]org mail[.]id-ar[.]org lnkprtl[.]id-ar[.]org\r\nlink-signal[.]id-ar[.]org id-ar[.]org app[.]id-ar[.]org\r\nyhtesting[.]accountservice[.]cc validate[.]accountservice[.]cc testingdhfhghd[.]accountservice[.]cc\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 2 of 26\n\ntesting[.]accountservice[.]cc review[.]accountservice[.]cc protect[.]accountservice[.]cc\r\nmail[.]accountservice[.]cc login[.]accountservice[.]cc accountservice[.]cc\r\naccount-protection[.]accountservice[.]cc ms-mng[.]ac mail[.]ms-mng[.]ac\r\ndssdgsdfsdf[.]ms-mng[.]ac signal-chat[.]cc mail[.]signal-chat[.]cc\r\nmail[.]ar-me[.]io join-zoom[.]ar-me[.]io connecting[.]ar-me[.]io\r\nconnect[.]ar-me[.]io ar-me[.]io verify-rev[.]ms-mng[.]ac\r\nhotel-menu[.]ms-mng[.]ac new-upl[.]signal-chat[.]cc ale-soun[.]com-en-us[.]info\r\nsignal-encryption[.]en-ar[.]net mail[.]en-ar[.]net en-ar[.]net\r\nmode-rec[.]org-status[.]nl sg-mng-rec[.]datamargin[.]org rec-mng-idmsic[.]datamargin[.]org\r\nmail[.]datamargin[.]org datamargin[.]org coonect-fc-cll-rec[.]datamargin[.]org\r\ncontu3r98fhdsjnksdfsdf[.]datamargin[.]org connact-ft-cll[.]datamargin[.]org rec-mng[.]ms-storedata[.]de\r\nrec-mng-mofagovbh[.]ms-storedata[.]de ms-storedata[.]de mofa-gov-bh[.]ms-storedata[.]de\r\nmain-auth[.]ms-storedata[.]de mail[.]ms-storedata[.]de join-team-invitation-web-call[.]ms-stored\r\ncont3ui4dsjk43ggfh[.]ms-storedata[.]de ww12[.]web-signal[.]org web-signal[.]org\r\nmode-rec[.]web-signal[.]org mail[.]web-signal[.]org download[.]web-signal[.]org\r\ncondjfh954thfdg[.]web-signal[.]org 4instalments[.]web-signal[.]org web-signal[.]org-status[.]nl\r\nweb-sgnl[.]org-status[.]nl signal[.]org-status[.]nl sgnl[.]org-status[.]nl\r\nsgnl-web[.]org-status[.]nl org-status[.]nl mail[.]org-status[.]nl\r\napp-signal[.]org-status[.]nl drive-i-cloud[.]com-ar[.]me mail[.]storemydata[.]re\r\nstoremydata[.]re storage-mofa-gov-bh[.]storemydata[.]re rec-ms-mof-gov-eg[.]storemydata[.]re\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 3 of 26\n\nrec-mng-bdf-bh[.]storemydata[.]re pasword-up-date-bdf-bh[.]storemydata[.]re ms-rec[.]storemydata[.]re\r\nms-rec-pmo-gov[.]bh[.]storemydata[.]re ms-rec-ncc-gov-bh[.]storemydata[.]re mofa-gov-bh[.]storemydata[.]re\r\ncall-ms-team[.]storemydata[.]re bh[.]storemydata[.]re rec-val-info[.]lang-ar[.]me\r\nmjkg3hurho34irh3o4iruh3oir34[.]lang-ar[.]me lang-ar[.]me ft-cll[.]lang-ar[.]me\r\nupdate-release-version-for-android[.]com-ar[.]me support[.]com-ar[.]me manage-ms[.]com-ar[.]me\r\nmail[.]com-ar[.]me join-call-zoommeeting[.]com-ar[.]me join-call-team-meeting[.]com-ar[.]me\r\nimanage[.]com-ar[.]me icloud[.]com-ar[.]me com-ar[.]me\r\nrec-mng[.]ms-storedata[.]me ms-storedata[.]me mail[.]ms-storedata[.]me\r\nsgnl-app[.]info dash[.]sgnlapp[.]info backup[.]sgnlapp[.]info\r\napp[.]sgnlapp[.]info api[.]sgnlapp[.]info admin[.]sgnlapp[.]info\r\naccount[.]sgnlapp[.]info\r\n90e37f6a-8a3c-4d06-80c9-\r\n5c9d7b967873[.]sgnlapp[.]info\r\n537b8bc1-bcb2-4d23-8eab-5b830ce6e7c6[.]sgnlapp[.]info\r\n4af34aec-0158-49cb-a696-\r\n44c9e4d03ed2[.]sgnlapp[.]info\r\n2fa-encryption[.]sgnlapp[.]info\r\n1a244584-c217-4ae7-87c5-\r\n3a77257a3f61[.]sgnlapp[.]info\r\nrwhpowebdisk[.]sgnlapp[.]info web-whatsapp[.]com-en-uk[.]info test[.]com-en-uk[.]info\r\nsignin-apple[.]com-en-uk[.]info login-apple[.]com-en-uk[.]info com-en-uk[.]info\r\ncall-video[.]com-en-uk[.]info big[.]com-en-uk[.]info ftpdr1[.]com-sa[.]co\r\nftpd[.]com-sa[.]co com-sa[.]co test[.]review-ar[.]co\r\nt1[.]review-ar[.]co signin-apple[.]review-ar[.]co signin-account[.]review-ar[.]co\r\nreview-ar[.]co number-appleid[.]review-ar[.]co login-live[.]review-ar[.]co\r\nlogin-apple[.]review-ar[.]co ids-login[.]review-ar[.]co id-login[.]review-ar[.]co\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 4 of 26\n\nid-appleid[.]review-ar[.]co host[.]review-ar[.]co get-fil[.]review-ar[.]co\r\nget-fi1[.]review-ar[.]co c[.]review-ar[.]co b[.]review-ar[.]co\r\nb[.]c[.]review-ar[.]co a[.]review-ar[.]co a[.]b[.]review-ar[.]co\r\na[.]b[.]c[.]review-ar[.]co sgnl-encryption-plugin[.]me-id[.]cc rev-number[.]me-id[.]cc\r\nme-id[.]cc i-mange[.]me-id[.]cc chec-res[.]me-id[.]cc\r\nhenry[.]scott85[.]mail[.]ru twitch9929312[.]com-ln[.]info test-acc[.]com-ln[.]info\r\ntakm[.]com-ln[.]info signin-yahoo[.]com-ln[.]info signin-live[.]com-ln[.]info\r\nremira[.]com-ln[.]info oportun[.]com-ln[.]info neww[.]com-ln[.]info\r\nnew[.]com-ln[.]info natim[.]com-ln[.]info login-cloud[.]com-ln[.]info\r\nget-hot[.]com-ln[.]info get-dh1[.]com-ln[.]info ebrands[.]com-ln[.]info\r\ncom-ln[.]info account-live[.]com-ln[.]info webvpn[.]mailbdf-bh[.]net\r\nvpn[.]mailbdf-bh[.]net staging[.]mailbdf-bh[.]net nhvkncpcalendars[.]mailbdf-bh[.]net\r\napp[.]mailbdf-bh[.]net adm[.]mailbdf-bh[.]net\r\n8437ee10-9da5-44b0-897c-749b07c47f41\r\nbh[.]net\r\n7d89036a-0e91-426f-b629-\r\n516286d7b053[.]mailbdf-bh[.]net\r\n349383a5-557c-43e0-a3e8-\r\n85ca92fc70d8[.]mailbdf-bh[.]net\r\njoin-factime[.]id-me[.]io\r\nid-me[.]io connecting[.]id-me[.]io connect[.]id-me[.]io\r\nconfirm-nums[.]id-me[.]io confirm-num[.]id-me[.]io appleid-apple[.]id-me[.]io\r\nauth-rev[.]ar-me[.]cc auth-rev-wi[.]ar-me[.]cc ar-me[.]cc\r\nappleid-apple[.]ar-me[.]cc alt-tyu[.]ar-me[.]cc aler78-fhgue[.]ar-me[.]cc\r\ndjhudft-wd[.]ar-me[.]cc me-en[.]io mail[.]me-en[.]io\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 5 of 26\n\njoin-wa[.]me-en[.]io facetime-webs[.]me-en[.]io facetime-web[.]me-en[.]io\r\nalet-new[.]me-en[.]io grafana[.]logs[.]re sitemaps[.]en-id[.]me\r\nsitemap[.]en-id[.]me mail[.]en-id[.]me m[.]en-id[.]me\r\nicloud[.]en-id[.]me icloud[.]com[.]en-id[.]me en-id[.]me\r\ncom[.]en-id[.]me appleid[.]apple[.]com[.]en-id[.]me apple[.]en-id[.]me\r\napple[.]com[.]en-id[.]me apple-id[.]com[.]en-id[.]me verify-identity[.]me-relay[.]org\r\nverify-identity-apple[.]me-relay[.]org tg[.]me-relay[.]org test[.]me-relay[.]org\r\nnew[.]me-relay[.]org mg-tg[.]me-relay[.]org members[.]me-relay[.]org\r\nme-relay[.]org mange-icl0ud[.]me-relay[.]org mail[.]me-relay[.]org\r\njoin-facetime[.]me-relay[.]org gtedywww[.]api[.]me-relay[.]org dev[.]me-relay[.]org\r\ndash[.]me-relay[.]org bvkfztg[.]me-relay[.]org\r\nb5f0a8b5-d161-4d11-afde-f82b48bb5766\r\nrelay[.]org\r\napp[.]me-relay[.]org api[.]me-relay[.]org account[.]me-relay[.]org\r\n60d22c9b-8946-4d84-b73c-3ff6610e49a1[.]me-relay[.]org5be54f27-d133-4414-ab97-\r\na28460472e9a[.]me-relay[.]org\r\n58352d6a-e1a4-489f-b46e-e74535bf677c\r\nrelay[.]org\r\n3aac32aa-df99-47f8-90c3-697dc9d98442[.]me-relay[.]org\r\nverify-apple[.]id-me[.]cc mail[.]id-me[.]cc\r\nid-me[.]cc eultewww[.]verify-apple[.]id-me[.]cc eulteverify-apple[.]id-me[.]cc\r\na33d9f71-6bcd-41d3-9f7d-50a90628551f[.]id-me[.]cc74d1f32b-1098-43c1-99ae-3d1d6e14afd7[.]id-me[.]cc\r\n027b1003-dd24-4e93-b74b-8282ff4d6586\r\nivqkiwebmail[.]mn-id[.]cc join-zoom-meeting[.]com-ar[.]re join-facetime[.]com-ar[.]re\r\nid-manage[.]com-ar[.]re com-ar[.]re app[.]ilability[.]net\r\nmail[.]track-portal[.]co manage-mofa-govbh[.]le-ar[.]me manage-ms[.]le-ar[.]me\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 6 of 26\n\njoin-call-zoom-meeting[.]le-ar[.]me join-call-team-meeting[.]le-ar[.]me gov-bh-mng-rec[.]le-ar[.]me\r\nauth-ms-manage[.]le-ar[.]me connecting[.]id-ar[.]cc connect[.]id-ar[.]cc\r\nconfirm-num[.]id-ar[.]cc aler762b-9873bc78[.]id-ar[.]cc flowiseai[.]en-account[.]info\r\nflow[.]uat[.]en-account[.]info flow-alpha[.]en-account[.]info en-account[.]info\r\nebmail[.]login-live[.]en-account[.]info\r\nebmail[.]login-live-online[.]en-account[.]info\r\nebmail[.]en-account[.]info\r\neblogin-live[.]en-account[.]info ebdisk[.]test-id[.]en-account[.]info ebdisk[.]login-live[.]en-account[.]info\r\nebdisk[.]en-account[.]info bi-ci[.]en-account[.]info\r\napi[.]ydtyuehugufgeygushguysgudyhg[.]e\r\naccount[.]info\r\n952cd7f5-55c2-472f-bc9d-08487ef75661[.]random[.]en-account[.]info84d4d991-f6cf-4225-b72a-0123fc2508f3[.]en-account[.]info\r\nydtyuehugufgeygushguysgudyhg[.]en-acc\r\nwildcard[.]en-account[.]info uat[.]en-account[.]info testid[.]en-account[.]info\r\ntest-id[.]en-account[.]info random[.]en-account[.]info mail[.]en-account[.]info\r\nlogin-live[.]en-account[.]info login-live-online[.]en-account[.]info trusted[.]app-info[.]app\r\ntotok-pro[.]app-info[.]app newsonline[.]ac mail[.]newsonline[.]ac\r\nmail[.]app-info[.]app app-info[.]app uk02web-zoom[.]ar-me[.]io\r\njoin-factime[.]id-ar[.]cc appleid-apple[.]id-ar[.]cc ale763873497ty73[.]id-me[.]io\r\niga[.]gov-bh-mng-rec[.]le-ar[.]me ww12[.]com-en-us[.]me ww1[.]com-en-us[.]me\r\ntest[.]com-en-us[.]me mail[.]com-en-us[.]me xsacwdc[.]totok-pro[.]ae\r\nmail[.]totok-pro[.]ae jdnfhu[.]totok-pro[.]ae download[.]totok-pro[.]ae\r\nre-ac[.]cc mzkkajh4rh3if9f3j4[.]re-ac[.]cc mng-re-conection[.]re-ac[.]cc\r\nmail[.]re-ac[.]cc loading-mng-blnk[.]re-ac[.]cc loading-cll-join-ft[.]re-ac[.]cc\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 7 of 26\n\nsignin-live[.]privacy-ar[.]com signin-ap[.]privacy-ar[.]com privacy-ar[.]com\r\nns2[.]privacy-ar[.]com ns1[.]privacy-ar[.]com new[.]privacy-ar[.]com\r\nmail[.]privacy-ar[.]com login-yahoo[.]privacy-ar[.]com login-apple[.]privacy-ar[.]com\r\njoin-zoom-meeting[.]privacy-ar[.]com fzbidxatfao[.]privacy-ar[.]com ftp[.]privacy-ar[.]com\r\ndwwbdgjdyvt[.]privacy-ar[.]com cicd[.]me-ar[.]io ci-flowise[.]me-ar[.]io\r\nbeta[.]superset[.]me-ar[.]io appleid-number[.]me-ar[.]io appleid-apple[.]me-ar[.]io\r\nalpha-visualize[.]me-ar[.]io\r\n6441056b613c32a9[.]appleid-number[.]me-ar[.]io\r\nuat[.]me-ar[.]io\r\ntess[.]me-ar[.]io superset[.]uat[.]me-ar[.]io superset[.]me-ar[.]io\r\nsuperset-production[.]me-ar[.]io signin-apple[.]me-ar[.]io sandbox[.]cicd[.]me-ar[.]io\r\nreview-appleid[.]me-ar[.]io report-prod[.]me-ar[.]io qa-insight[.]me-ar[.]io\r\npreview-visualizations[.]me-ar[.]io ns2[.]me-ar[.]io ns1[.]me-ar[.]io\r\nneww[.]me-ar[.]io new2[.]me-ar[.]io new1[.]me-ar[.]io\r\nnew[.]me-ar[.]io me-ar[.]io mail[.]me-ar[.]io\r\nlogin-office[.]me-ar[.]io login-apple[.]me-ar[.]io flowise[.]uat[.]me-ar[.]io\r\nemv1[.]me-ar[.]io development-flowiseai[.]me-ar[.]io encryption-sgnl-infor[.]mation[.]re\r\ndrive-i-cloud-infor[.]mation[.]re review-apple[.]info-ar[.]cc nums-apple[.]info-ar[.]cc\r\nnum-apple[.]info-ar[.]cc info-ar[.]cc get-mywords[.]info-ar[.]cc\r\ndelivery-dhl[.]info-ar[.]cc mail[.]ilability[.]net llk4nrkl3rnlke3dl4jr30ij030ej0984jiedj04\r\nilability[.]net humatropeava[.]ilability[.]net d96ff356-4b58-440d-bc5c-4105f95e37da\r\ncheck-data-av[.]ilability[.]net ver-information[.]id-us[.]ca review-apple[.]id-us[.]ca\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 8 of 26\n\nmail[.]id-us[.]ca id-us[.]ca bb[.]id-us[.]ca\r\naa[.]id-us[.]ca test[.]id-en[.]net number-signal[.]id-en[.]net\r\nnews-reuters-com[.]id-en[.]net news-jpost-com[.]id-en[.]net mail[.]id-en[.]net\r\nlink-signal[.]id-en[.]net join-signal[.]id-en[.]net id-en[.]net\r\nconnect-signal[.]id-en[.]net 2fa-signal[.]id-en[.]net wishduv[.]id-en[.]me\r\nwidethh[.]id-en[.]me test[.]auth[.]id-en[.]me server[.]id-en[.]me\r\nrec-auth[.]id-en[.]me jhgjhgjg[.]id-en[.]me id-en[.]me\r\nbroadcase[.]id-en[.]me auth[.]id-en[.]me auth-rev[.]id-en[.]me\r\nauth-manage[.]id-en[.]me xyz-alt[.]id-en[.]co review-apple[.]id-en[.]co\r\nnums-rev[.]id-en[.]co num-revs[.]id-en[.]co num-rev[.]id-en[.]co\r\nmail[.]id-en[.]co join-facetime[.]id-en[.]co id-en[.]co\r\nft-revs[.]id-en[.]co ft-rev[.]id-en[.]co ft-join[.]id-en[.]co\r\nvbnm-altr[.]id-ar[.]me review-apple[.]id-ar[.]me nums-rev[.]id-ar[.]me\r\nnum-rev[.]id-ar[.]me mail[.]id-ar[.]me join-facetime[.]id-ar[.]me\r\nid-ar[.]me ftp[.]id-ar[.]me ft-rev[.]id-ar[.]me\r\nft-joins[.]id-ar[.]me ft-join[.]id-ar[.]me autoconfig[.]id-ar[.]me\r\nmail[.]en-uk[.]cc ids-ac[.]en-uk[.]cc get-too[.]en-uk[.]cc\r\nget-alr[.]en-uk[.]cc event-nottingham[.]en-uk[.]cc en-uk[.]cc\r\nconfirm-id[.]en-uk[.]cc appleid[.]en-uk[.]cc api[.]en-uk[.]cc\r\nac-id[.]en-uk[.]cc abc1[.]en-uk[.]cc abc[.]en-uk[.]cc\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 9 of 26\n\n54864-ov[.]en-uk[.]cc test4[.]en-uk[.]cc test2[.]en-uk[.]cc\r\ntest[.]en-uk[.]cc review-ids[.]en-uk[.]cc review-id[.]en-uk[.]cc\r\nreview-appleid[.]en-uk[.]cc one-likeme[.]en-uk[.]cc numbers-appleid[.]en-uk[.]cc\r\nnumber-signin[.]en-uk[.]cc number-review[.]en-uk[.]cc number-login[.]en-uk[.]cc\r\nnumber-appleid[.]en-uk[.]cc manage-id[.]en-uk[.]cc parcel-information[.]en-id[.]net\r\ncourier-assignment[.]en-id[.]net widjhdoijhoisudof[.]serviceinfo[.]cc shryg87uhisd[.]serviceinfo[.]cc\r\nserviceinfo[.]cc blksuy8uwhbuioysd[.]serviceinfo[.]cc alerjf7uh3ui8ys[.]serviceinfo[.]cc\r\nen-id[.]cc drive-kenza-cv-pdf[.]en-id[.]cc connecting[.]en-id[.]cc\r\nconnect[.]info[.]en-id[.]cc connect-signal[.]en-id[.]cc ch-th-re[.]en-id[.]cc\r\nbltki[.]en-id[.]cc auth-subb[.]en-id[.]cc auth-rev[.]en-id[.]cc\r\nappleid-apple-com[.]en-id[.]cc al-ap-cl[.]en-id[.]cc wdki[.]en-id[.]cc\r\nsttrn[.]en-id[.]cc short[.]en-id[.]cc rstl[.]en-id[.]cc\r\nrev[.]en-id[.]cc rev-id[.]en-id[.]cc my-call-join[.]en-id[.]cc\r\nms[.]connecting[.]en-id[.]cc ms[.]connect[.]info[.]en-id[.]cc manage-delivery[.]en-id[.]cc\r\nmail[.]en-id[.]cc log[.]rev[.]en-id[.]cc join-the-calls[.]en-id[.]cc\r\njoin-the-call[.]en-id[.]cc join-teams[.]en-id[.]cc join-my-calls[.]en-id[.]cc\r\njoin-facetime[.]en-id[.]cc info[.]en-id[.]cc info-team[.]en-id[.]cc\r\ngaza-report[.]en-id[.]cc facetime-apple[.]en-id[.]cc xsadasd[.]en-ar[.]co\r\nmail[.]en-ar[.]co mail-auth[.]en-ar[.]co en-ar[.]co\r\nxyz-abv[.]connect-signal[.]org mail[.]connect-signal[.]org img8732g97[.]connect-signal[.]org\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 10 of 26\n\nconnect-signal[.]org cli38798d7983[.]connect-signal[.]org autoconfig[.]lcloud[.]com-service[.]info\r\nautoconfig[.]com-service[.]info apple[.]com-service[.]info account-yahoo[.]com-service[.]info\r\naccount-live[.]com-service[.]info testid[.]com-service[.]info mail[.]com-service[.]info\r\nlogin-cloud[.]com-service[.]info login-account[.]com-service[.]info lcloud[.]com-service[.]info\r\nicloud[.]com-service[.]info facetime-apple[.]com-service[.]info com-service[.]info\r\nassets[.]com-info[.]io apple[.]com-info[.]io app[.]com-info[.]io\r\napi[.]com-info[.]io a[.]com-info[.]io\r\n8e968722-92c0-4944-93da-58c9ad8f7eeb\r\ninfo[.]io\r\n7381d8b7-6549-4c38-8f8e-069e1c25a577[.]com-info[.]io69f65276-f9bc-40d9-9b53-\r\nc3afe3abf4fb[.]com-info[.]io\r\nsm[.]sscomusted-device-apple[.]com-info\r\nsm[.]comusted-device-apple[.]com-info[.]io sjoin-facetime[.]com-info[.]io sitemaps[.]com-info[.]io\r\nsitemap[.]com-info[.]io scomusted-device-apple[.]com-info[.]io sapple[.]com-info[.]io\r\ns[.]com-info[.]io rev-num-apl[.]com-info[.]io maisqsssssm[.]sverify-apple[.]com-info[.]\r\nmail[.]com-info[.]io m[.]verify-apple[.]com-info[.]io m[.]trusted-device-apple[.]com-info[.]io\r\nm[.]sverify-apple[.]com-info[.]io m[.]ssverify-apple[.]com-info[.]io m[.]ssssverify-apple[.]com-info[.]io\r\nm[.]sssssverify-apple[.]com-info[.]io m[.]ssssssverify-apple[.]com-info[.]io m[.]sssssssverify-apple[.]com-info[.]io\r\nm[.]sssssssssverify-apple[.]com-info[.]io\r\nm[.]sscomusted-device-apple[.]com-info[.]io\r\nm[.]scomusted-device-apple[.]com-info[.]\r\nm[.]sapple[.]com-info[.]io m[.]comusted-device-apple[.]com-info[.]io logmnzth[.]com-info[.]io\r\njyitmsapple[.]com-info[.]io join-facetime[.]com-info[.]io ixcmym[.]sapple[.]com-info[.]io\r\nirthhm[.]scomusted-device-apple[.]com-info[.]io icloud-apple[.]com-info[.]io holykssm[.]trusted-device-apple[.]com-in\r\ngmflqsssssssssverify-apple[.]com-info[.]io ft-num-apl[.]com-info[.]io ff050e03-e7c3-44f0-9366-b7b739da0d9e[\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 11 of 26\n\nf368b859-dc30-448c-9587-44879cf4a730[.]com-info[.]io\r\ndev[.]com-info[.]io demo[.]com-info[.]io\r\ncpjkdafdrw[.]com-info[.]io comusted-device-apple[.]com-info[.]io com-info[.]io\r\nblog[.]com-info[.]io\r\nb4622d8c-9d06-4fb2-b02e-af37631d5365[.]com-info[.]io\r\nverify-apple[.]com-info[.]io\r\nufuzzssssm[.]verify-apple[.]com-info[.]io trusted-device-apple[.]com-info[.]io test[.]com-info[.]io\r\nsverify-apple[.]com-info[.]io staging[.]com-info[.]io ssverify-apple[.]com-info[.]io\r\nsssverify-apple[.]com-info[.]io ssssverify-apple[.]com-info[.]io sssssverify-apple[.]com-info[.]io\r\nssssssverify-apple[.]com-info[.]io ssssssssverify-apple[.]com-info[.]io sssssssssverify-apple[.]com-info[.]io\r\nsssssssverify-apple[.]com-info[.]io ssssssssm[.]verify-apple[.]com-info[.]io ssssssm[.]verify-apple[.]com-info[.]io\r\nssssssm[.]sverify-apple[.]com-info[.]io ssssssm[.]ssverify-apple[.]com-info[.]io sssssm[.]verify-apple[.]com-info[.]io\r\nsssssm[.]sverify-apple[.]com-info[.]io sssssm[.]ssverify-apple[.]com-info[.]io ssssm[.]verify-apple[.]com-info[.]io\r\nssssm[.]sverify-apple[.]com-info[.]io ssssm[.]ssverify-apple[.]com-info[.]io sssm[.]verify-apple[.]com-info[.]io\r\nsssm[.]trusted-device-apple[.]com-info[.]io sssm[.]sverify-apple[.]com-info[.]io sssm[.]ssverify-apple[.]com-info[.]io\r\nsssm[.]ssssverify-apple[.]com-info[.]io ssm[.]verify-apple[.]com-info[.]io ssm[.]trusted-device-apple[.]com-info[.]io\r\nssm[.]sverify-apple[.]com-info[.]io ssm[.]ssverify-apple[.]com-info[.]io ssm[.]ssssverify-apple[.]com-info[.]io\r\nssm[.]sscomusted-device-apple[.]com-info[.]io\r\nssm[.]comusted-device-apple[.]com-info[.]io\r\nsslhjsssssverify-apple[.]com-info[.]io\r\nsscomusted-device-apple[.]com-info[.]io ssapple[.]com-info[.]io sm[.]verify-apple[.]com-info[.]io\r\nsm[.]trusted-device-apple[.]com-info[.]io sm[.]sverify-apple[.]com-info[.]io sm[.]ssverify-apple[.]com-info[.]io\r\nsm[.]ssssverify-apple[.]com-info[.]io sm[.]sssssssssverify-apple[.]com-info[.]io zoom[.]com-info[.]io\r\nzjzmfsssm[.]ssssverify-apple[.]com-info[.]io\r\nzhsexssssssm[.]ssverify-apple[.]com-info[.]io\r\nxnwhrsssssm[.]ssverify-apple[.]com-info[\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 12 of 26\n\ncom-en-uk[.]co com-remove[.]info com-ar-me[.]info\r\nns2[.]com-en[.]cc ns1[.]com-en[.]cc mail[.]com-en[.]cc\r\nlogin-apple[.]com-en[.]cc ftp[.]com-en[.]cc exmo[.]com-en[.]cc\r\ncom-en[.]cc appleid-apple[.]com-en[.]cc m[.]number-appleid[.]com-auth[.]cc\r\nlogin-appleid[.]com-auth[.]cc login-apple[.]com-auth[.]cc ids-appleid[.]com-auth[.]cc\r\nid-appleid[.]com-auth[.]cc ftp[.]com-auth[.]cc com-auth[.]cc\r\ncheck-alt[.]com-auth[.]cc appleid-number[.]com-auth[.]cc appleid-apple[.]com-auth[.]cc\r\napple[.]com-auth[.]cc tyskw-appleid[.]com-auth[.]cc signin-appleid[.]com-auth[.]cc\r\nreview-appleid[.]com-auth[.]cc numbers-appleid[.]com-auth[.]cc number-appleid[.]com-auth[.]cc\r\nneww[.]com-auth[.]cc new[.]com-auth[.]cc mail[.]com-auth[.]cc\r\nreview-appleid[.]com-ar[.]io new[.]com-ar[.]io mail[.]com-ar[.]io\r\ncom-ar[.]io appleid-number[.]com-ar[.]io appleid-apple[.]com-ar[.]io\r\nreportsuscripcion[.]apple[.]com-ar[.]info reportproblem[.]apple[.]com-ar[.]info mail[.]com-ar[.]info\r\nlcloud[.]com-ar[.]info iforgot-applehelp[.]com-ar[.]info icloud[.]com-ar[.]info\r\ncom-ar[.]info appleid[.]com-ar[.]info appleid-apple[.]com-ar[.]info\r\napple[.]com-ar[.]info dash[.]com-ae[.]org crm[.]com-ae[.]org\r\ncom-ae[.]org clients[.]com-ae[.]org client[.]com-ae[.]org\r\ncheckdata[.]com-ae[.]org blog[.]com-ae[.]org backend[.]com-ae[.]org\r\napp[.]com-ae[.]org api[.]com-ae[.]org ae3eb0c0-ab31-4ea7-a29c-c5886e35721a\r\nadmin[.]com-ae[.]org account[.]com-ae[.]org 99e27236-9c0a-4c7f-b114-f181d0c00173\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 13 of 26\n\n76194fdc-fde2-4128-b4e5-6e185e89d224[.]com-ae[.]org\r\n43e92d22-0923-4424-8e4c-6f1aa0397af4[.]com-ae[.]org\r\nzpciomail[.]com-ae[.]org\r\nwebtest[.]com-ae[.]org testy[.]com-ae[.]org testing[.]com-ae[.]org\r\ntest[.]com-ae[.]org t-mobile[.]com-ae[.]org stg[.]com-ae[.]org\r\nstaging[.]com-ae[.]org stage[.]com-ae[.]org portal[.]com-ae[.]org\r\nold[.]com-ae[.]org new[.]com-ae[.]org members[.]com-ae[.]org\r\nmail[.]com-ae[.]org lhyjkqcm[.]com-ae[.]org kb[.]com-ae[.]org\r\njoin-call-facetime[.]com-ae[.]org\r\nipnzrwww[.]join-call-facetime[.]com-ae[.]org\r\nf745f976-7714-445e-abf6-66fc1ab0a7bb[\r\nf127d70b-1bcf-4915-9868-768000ef915d[.]com-ae[.]org\r\nencryption-signal[.]com-ae[.]org dsbjbjhb5teufyh85ybf74fbufb7tuvfbf[.]co\r\ndocs[.]com-ae[.]org dev[.]com-ae[.]org demo[.]com-ae[.]org\r\ndashboard[.]com-ae[.]org zoom-meet[.]ar-me[.]cc tehisdjsd[.]ar-info[.]co\r\nrec[.]ar-info[.]co mail[.]ar-info[.]co connect[.]ar-info[.]co\r\nauth[.]rec[.]ar-info[.]co auth[.]connect[.]ar-info[.]co auth-rev[.]ar-info[.]co\r\nar-info[.]co vhpniqnpchepkxqbsfcjcpanel[.]ar-id[.]co testing[.]ar-id[.]co\r\ntest[.]ar-id[.]co staging[.]ar-id[.]co rxuoiwebmail[.]ar-id[.]co\r\nqnpchepkxqbsfcjcpanel[.]ar-id[.]co portal[.]ar-id[.]co omwtrgap[.]ar-id[.]co\r\nkswqfmry[.]ar-id[.]co docs[.]ar-id[.]co demo[.]ar-id[.]co\r\ndashboard[.]ar-id[.]co confirm-your-identity[.]ar-id[.]co ck02-fb1ef20944-89b8cbf0[.]ar-id[.]co\r\nbeta[.]ar-id[.]co backend[.]ar-id[.]co b0d782ca-68ae-4ea6-adea-db30255b4786\r\nasset[.]ar-id[.]co app[.]ar-id[.]co api[.]ar-id[.]co\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 14 of 26\n\nadmin[.]ar-id[.]co\r\n53aef03b-0a86-4497-8c1e-23cfcd9f96e5[.]ar-id[.]co\r\nverify-id[.]acc-mn[.]info\r\ntrusted-device-apple[.]acc-mn[.]info test[.]acc-mn[.]info sgnl-link-device[.]acc-mn[.]info\r\nmail[.]acc-mn[.]info join-facetime[.]acc-mn[.]info imanage-rev[.]acc-mn[.]info\r\nicloudrive[.]acc-mn[.]info ft-rev[.]acc-mn[.]info acc-mn[.]info\r\n734yhihudnsifsdf[.]acc-mn[.]info hi[.]ac-us[.]cc hello[.]ac-us[.]cc\r\nappleid-verify[.]ac-us[.]cc ac-us[.]cc testsjdfhksdhfksdf[.]botim-app[.]pro\r\nmail[.]botim-app[.]pro download[.]botim-app[.]pro botim-app[.]pro\r\nwtzdscpanel[.]logs[.]re sgnl-org[.]logs[.]re rv-mn-en[.]logs[.]re\r\nnhcpowtzdscpanel[.]logs[.]re mail[.]logs[.]re logs[.]re\r\nkkkwazhbwmwww[.]ft-cll[.]logs[.]re join-facetime[.]logs[.]re imanage[.]logs[.]re\r\nhostmaster[.]logs[.]re haven[.]logs[.]re ft-cll[.]logs[.]re\r\ndocument-cloud[.]logs[.]re dayxfgtb[.]logs[.]re coj599r8re8c98r9c99c9[.]logs[.]re\r\nbf4398aa-a6c5-4a80-bfda-68132f32059d[.]logs[.]re\r\n2fa-sgnl[.]logs[.]re idms-mng-rec[.]fullrestores[.]re\r\nmail[.]datarestores[.]nl idms-sgnl-mn[.]datarestores[.]nl idms-rec[.]datarestores[.]nl\r\nidms-mng-rec[.]datarestores[.]nl idms-ft-cll-mng[.]datarestores[.]nl ft-cll-2wefhf34iojofj0ef98h98sd[.]datares\r\ncontrol394sdsdf[.]datarestores[.]nl datarestores[.]nl zoom-uk[.]ar-me[.]cc\r\ntheguardian[.]ar-me[.]cc signin-guardian[.]ar-me[.]cc shrtrn[.]ar-me[.]cc\r\nshrt-ap[.]ar-me[.]cc review-apple[.]ar-me[.]cc resmhcx57[.]ar-me[.]cc\r\nnumber-cof[.]ar-me[.]cc number-co[.]ar-me[.]cc mail[.]ar-me[.]cc\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 15 of 26\n\njoin[.]ar-me[.]cc join-wd-facetime[.]ar-me[.]cc join-us[.]ar-me[.]cc\r\njoin-facetime[.]ar-me[.]cc join-face[.]ar-me[.]cc ft-wd[.]ar-me[.]cc\r\nft-blk[.]ar-me[.]cc connecting[.]ar-me[.]cc connect[.]ar-me[.]cc\r\nconfirm-number[.]ar-me[.]cc number[.]id-en[.]io appleid-apple[.]id-en[.]io\r\nwebs-ft[.]com-me[.]io web-ft[.]com-me[.]io pdf-cloud[.]com-me[.]io\r\nnumber[.]com-me[.]io mail[.]com-me[.]io com-me[.]io\r\nappleid-apple[.]com-me[.]io alet-uebu[.]com-me[.]io manage-iservices[.]en-ir[.]org\r\nmail[.]en-ir[.]org join-call[.]bot[.]en-ir[.]org imanage[.]en-ir[.]org\r\nencryption-sgnl[.]en-ir[.]org bot[.]en-ir[.]org 2fa-sgnl[.]en-ir[.]org\r\nnum-wid[.]me-info[.]io num-blk[.]me-info[.]io me-info[.]io\r\nmail[.]me-info[.]io join-facetime[.]me-info[.]io ft-wid[.]me-info[.]io\r\nft-blk[.]me-info[.]io appleid-apple[.]me-info[.]io ale-soun[.]me-info[.]io\r\nzoom-meet[.]com-cc[.]io uk05web-zoom[.]com-cc[.]io mail[.]com-cc[.]io\r\nfacetime-nums[.]com-cc[.]io facetime-num[.]com-cc[.]io com-cc[.]io\r\naler-new[.]com-cc[.]io mng-num-blk[.]ar-id[.]cc mail[.]ar-id[.]cc\r\nkajkjsa[.]j34idf[.]ar-id[.]cc j34idf[.]ar-id[.]cc ft-cll-join[.]ar-id[.]cc\r\nencrytpion-sgnl[.]ar-id[.]cc encryption-sgnl[.]ar-id[.]cc ar-id[.]cc\r\nappleids-trusted-number[.]ar-id[.]cc appleids-manage[.]ar-id[.]cc sgnl[.]org-ar[.]net\r\norg-ar[.]net num-blk[.]org-ar[.]net mail[.]org-ar[.]net\r\nidentity[.]org-ar[.]net id-apples-mange[.]org-ar[.]net hydtr[.]org-ar[.]net\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 16 of 26\n\nencryption-sgnl[.]org-ar[.]net dhl[.]org-ar[.]net call-facetime[.]org-ar[.]net\r\nappleids[.]org-ar[.]net appleids-truted-number[.]org-ar[.]net yqgsfstaging[.]ale-soun[.]com-en-us[.]info\r\nwow-way[.]com-en-us[.]info meeting[.]zm-me[.]co mail[.]host[.]zm-me[.]co\r\nautoconfig[.]host[.]zm-me[.]co sky-security[.]id-ar[.]ca shghgwhasd[.]id-ar[.]ca\r\nid-ar[.]ca untvhjoin-call-facetime[.]relay-ar[.]co tication[.]net\r\nmail[.]cc-ar[.]co cc-ar[.]co review-apple[.]id-ar[.]cc\r\nress[.]id-ar[.]cc num-revw[.]id-ar[.]cc num-rev[.]id-ar[.]cc\r\nmail[.]id-ar[.]cc join-facetime[.]id-ar[.]cc id-ar[.]cc\r\nft-revw[.]id-ar[.]cc ft-rev[.]id-ar[.]cc abde-alt[.]id-ar[.]cc\r\nabcdef[.]ress[.]id-ar[.]cc protect-bdf-bh[.]owa365[.]org owa365[.]org\r\nmail[.]owa365[.]org mail-bdf-bh[.]owa365[.]org test[.]regularsports[.]org\r\nsdfgfdg[.]regularsports[.]org myftasdffg[.]regularsports[.]org mail[.]regularsports[.]org\r\ndev[.]regularsports[.]org regularsports[.]org mpl[.]jcha[.]com-us[.]io\r\nmail[.]com-us[.]io join-faetime[.]com-us[.]io join-facetime[.]com-us[.]io\r\njcha[.]com-us[.]io hgjsdfsdf[.]com-us[.]io com-us[.]io\r\ncall-ft-connect[.]com-us[.]io test[.]final-restore[.]re rec-mng-idmss[.]final-restore[.]re\r\nrec-mng-bdf-gov-bh[.]final-restore[.]re rec-check[.]final-restore[.]re rec-check-mng[.]final-restore[.]re\r\nms-rec-mng[.]final-restore[.]re mng-rec[.]final-restore[.]re mng-rec-mofa-bh[.]final-restore[.]re\r\nmng-rec-idmsgnls[.]final-restore[.]re mail[.]final-restore[.]re ft-cll-idmss-rec-mng[.]final-restore[.]re\r\nfinal-restore[.]re file-check[.]final-restore[.]re controlslsdf9h9s93t54[.]final-restore[.]re\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 17 of 26\n\ntotokpro[.]app-info[.]me totok-pro[.]app-info[.]me tg-secure-call[.]app-info[.]me\r\nrec-cal-tg[.]app-info[.]me mail[.]app-info[.]me join-securecall-tg[.]app-info[.]me\r\napp-info[.]me 2fa-authentication[.]sgnlapp[.]info verify-mofa-gov-bh[.]le-ar[.]me\r\nverify-bdf[.]le-ar[.]me verify-app[.]le-ar[.]me mail[.]le-ar[.]me\r\nle-ar[.]me join-facetime-call[.]le-ar[.]me drive-cloud-app[.]le-ar[.]me\r\nnum-auth-wtid[.]me-info[.]cc num-auth-blk[.]me-info[.]cc mail[.]me-info[.]cc\r\ncon-ft-cll[.]me-info[.]cc signal[.]org-ar[.]me org-ar[.]me\r\nmail[.]org-ar[.]me link-device-signal[.]org-ar[.]me encryption-key-plugin-signal[.]org-ar[.]m\r\nxbwzeasg[.]sgnlapp[.]info web[.]sgnlapp[.]info v2[.]sgnlapp[.]info\r\nv1[.]sgnlapp[.]info uat[.]sgnlapp[.]info testing[.]sgnlapp[.]info\r\ntest[.]sgnlapp[.]info stg[.]sgnlapp[.]info staging[.]sgnlapp[.]info\r\nstage[.]sgnlapp[.]info secure[.]sgnlapp[.]info rustore[.]sgnlapp[.]info\r\nqa[.]sgnlapp[.]info pxemgvuslqassets[.]sgnlapp[.]info portal[.]sgnlapp[.]info\r\nnew[.]sgnlapp[.]info marketing[.]sgnlapp[.]info mailer[.]sgnlapp[.]info\r\nmail[.]sgnlapp[.]info encryption[.]sgnlapp[.]info encryption-plugin[.]sgnlapp[.]info\r\nencryption-plug-in[.]sgnlapp[.]info docs[.]sgnlapp[.]info dev[.]sgnlapp[.]info\r\ndemo[.]sgnlapp[.]info dashboard[.]sgnlapp[.]info mail[.]connect-signal[.]me\r\nmail[.]signal-account[.]org link[.]signal-account[.]org dgsgsd[.]signal-account[.]org\r\ncall[.]signal-account[.]org num-signal-org[.]en-info[.]co mail[.]en-info[.]co\r\nlink-signal-org[.]en-info[.]co en-info[.]co totokupdate[.]ai\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 18 of 26\n\ntotok-shop[.]com totok-pro[.]io totok-pro[.]app\r\nstore[.]latestversion[.]ai store[.]appupdate[.]ai static[.]appupdate[.]ai\r\nspiralkey[.]co signal[.]ct[.]ws signal-encryption-service[.]ct[.]ws\r\nnoblico[.]net mail[.]app-totok[.]io latestversion[.]ai\r\ndownload[.]appupdate[.]ai appupdate[.]ai app-totok[.]io\r\nai-messenger[.]co review-apple[.]ids-ar[.]co num-revw[.]ids-ar[.]co\r\nnum-rev[.]ids-ar[.]co mail[.]ids-ar[.]co join-wa[.]ids-ar[.]co\r\njoin-facetime[.]ids-ar[.]co ftp[.]ids-ar[.]co ft-revw[.]ids-ar[.]co\r\nft-rev[.]ids-ar[.]co abcde-ress[.]ids-ar[.]co abc-newalt[.]ids-ar[.]co\r\nids-ar[.]co svr-drive[.]com ssl[.]share[.]svr-drive[.]com\r\nssl[.]google[.]svr-drive[.]com signaler-pa[.]share[.]svr-drive[.]com signaler-pa[.]google[.]svr-drive[.]com\r\nshare[.]svr-drive[.]com\r\nsecuritydomain-pa[.]share[.]svr-drive[.]com\r\nsecuritydomain-pa[.]google[.]svr-drive[.]c\r\nplay[.]share[.]svr-drive[.]com play[.]google[.]svr-drive[.]com optimizationguide-pa[.]share[.]svr-drive[.\r\noptimizationguide-pa[.]google[.]svr-drive[.]com ogs[.]share[.]svr-drive[.]com ogs[.]google[.]svr-drive[.]com\r\nmyaccount[.]share[.]svr-drive[.]com myaccount[.]google[.]svr-drive[.]com gstatic-fonts[.]share[.]svr-drive[.]com\r\ngstatic-fonts[.]google[.]svr-drive[.]com googleapis-fonts[.]share[.]svr-drive[.]com googleapis-fonts[.]google[.]svr-drive[.]co\r\ngoogle[.]svr-drive[.]com clients6[.]share[.]svr-drive[.]com clients6[.]google[.]svr-drive[.]com\r\nclients5[.]share[.]svr-drive[.]com clients5[.]google[.]svr-drive[.]com clients4[.]share[.]svr-drive[.]com\r\nclients4[.]google[.]svr-drive[.]com clients3[.]share[.]svr-drive[.]com clients3[.]google[.]svr-drive[.]com\r\nclients2[.]share[.]svr-drive[.]com clients2[.]google[.]svr-drive[.]com clients1[.]share[.]svr-drive[.]com\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 19 of 26\n\nclients1[.]google[.]svr-drive[.]com clients[.]share[.]svr-drive[.]com clients[.]google[.]svr-drive[.]com\r\napis[.]share[.]svr-drive[.]com apis[.]google[.]svr-drive[.]com android[.]clients[.]share[.]svr-drive[.]com\r\nandroid[.]clients[.]google[.]svr-drive[.]com accounts[.]share[.]svr-drive[.]com accounts[.]google[.]svr-drive[.]com\r\naccountcapabilities-pa[.]share[.]svr-drive[.]com join-facetime[.]org-ar[.]net join-facetime[.]me-en[.]io\r\njoin-facetime[.]id-me[.]cc join-facetime[.]en-ir[.]org join-facetime[.]com-me[.]io\r\njoin-facetime[.]com-cc[.]io join-facetime[.]ar-id[.]cc call-join-facetime[.]ar-id[.]cc\r\nw[.]entity-me[.]online uat[.]entity-me[.]online staging[.]entity-me[.]online\r\nnew[.]entity-me[.]online mail[.]entity-me[.]online jkhjkrkwejrhjsfhkjshrtre[.]entity-me[.]onl\r\nfjrbelnjkgl4ntglnfk4rnlkednfoikrnfiornogb[.]entity-me[.]online\r\nentity-me[.]online dev[.]entity-me[.]online\r\ncall-ft-join-id[.]entity-me[.]online bmail[.]entity-me[.]online bdisk[.]entity-me[.]online\r\nbackup[.]entity-me[.]online asdfkljlkdsdd[.]entity-me[.]online app[.]entity-me[.]online\r\napi[.]entity-me[.]online aging[.]entity-me[.]online review-appleid[.]me-en[.]cc\r\nnumber-appleid[.]me-en[.]cc new[.]me-en[.]cc mng-info[.]me-en[.]cc\r\nmng-id-val[.]me-en[.]cc mn-id[.]me-en[.]cc me-en[.]cc\r\nmanage[.]me-en[.]cc manage-id[.]me-en[.]cc mamsdjlahdiu39r73y93y934r79r[.]me-en\r\nmail[.]me-en[.]cc join-facetime[.]me-en[.]cc id-validate[.]me-en[.]cc\r\nid-mana-ge[.]me-en[.]cc ftp[.]me-en[.]cc ft-cll[.]me-en[.]cc\r\n2fa-mange[.]me-en[.]cc 2fa-manage[.]me-en[.]cc signin-office[.]id-ar[.]ca\r\nverify-apple-account-val[.]idate[.]me sgnl-2fa-authentication[.]idate[.]me secure-val[.]idate[.]me\r\nmta-sts[.]mail[.]idate[.]me mail[.]idate[.]me lalnrctonpao[.]idate[.]me\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 20 of 26\n\nidentity-vel[.]idate[.]me identity-val[.]idate[.]me idate[.]me\r\nhostmaster[.]idate[.]me drive-icloud-val[.]idate[.]me dhl-delivery-verification[.]idate[.]me\r\ndata-val[.]idate[.]me conjhgfkjrg3jk4rgk3jfskjd[.]idate[.]me alumni-columbia-edu-val[.]idate[.]me\r\nsdfhsfdj[.]com-ae[.]net mail[.]com-ae[.]net com-ae[.]net\r\nandroid[.]com-ae[.]net zm-web[.]id-ar[.]ca xyz-alt[.]id-ar[.]ca\r\nus05web-join-zoom-meeting[.]id-ar[.]ca testt[.]id-ar[.]ca test[.]id-ar[.]ca\r\nsignal-link-call[.]id-ar[.]ca rin-ss[.]id-ar[.]ca pending-office[.]id-ar[.]ca\r\npdf-sdsg8347gyeduy49yfhf6437gfyrf436[.]id-ar[.]ca\r\nnumb[.]id-ar[.]ca num-signal[.]id-ar[.]ca\r\nmail[.]id-ar[.]ca login-office[.]id-ar[.]ca login-office-validate-identity[.]id-ar[.]ca\r\nlogin-office-auth[.]id-ar[.]ca login-mofa-office[.]id-ar[.]ca link-signal[.]id-ar[.]ca\r\nexample[.]id-ar[.]ca call-signal[.]id-ar[.]ca 2[.]id-ar[.]ca\r\nst-prtl[.]hm-en[.]cc mail[.]hm-en[.]cc m-s-info[.]hm-en[.]cc\r\nhot-acc-mail[.]hm-en[.]cc hm-en[.]cc dfdsgsdgsfg[.]hm-en[.]cc\r\nconnect-signal[.]hm-en[.]cc conne[.]hm-en[.]cc acc-hot-mail[.]hm-en[.]cc\r\nrec-mng-infor[.]mation-ae[.]re permanent-infor[.]mation-ae[.]re mng-infor[.]mation-ae[.]re\r\nmation-ae[.]re mail[.]mation-ae[.]re sdgsdgsgfdgsdfhdfhdfh[.]ht-id[.]me\r\nmsoft[.]ht-id[.]me mail[.]ht-id[.]me ht-id[.]me\r\nauth-rev[.]ht-id[.]me testing[.]me-mng[.]cc sdfgsdf[.]me-mng[.]cc\r\nme-mng[.]cc mail[.]me-mng[.]cc ft-cll[.]me-mng[.]cc\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 21 of 26\n\nblnk-num-mng[.]me-mng[.]cc\r\nuntvhwww[.]join-call-facetime[.]relay-ar[.]co\r\nsecurity[.]icloud[.]relay-ar[.]co\r\nrelay-ar[.]co mail[.]relay-ar[.]co kgpcaelw[.]relay-ar[.]co\r\njoin-call-facetime[.]relay-ar[.]co icloud[.]relay-ar[.]co enfiaqkw[.]relay-ar[.]co\r\ndev[.]relay-ar[.]co demo[.]relay-ar[.]co asdf[.]relay-ar[.]co\r\napp[.]relay-ar[.]co api[.]relay-ar[.]co admin[.]relay-ar[.]co\r\nupdate-nums[.]id-ar[.]co update-num[.]id-ar[.]co testid[.]new[.]id-ar[.]co\r\nreview-apple[.]id-ar[.]co pdf-icloud[.]id-ar[.]co nums-rev[.]id-ar[.]co\r\nnum-wrevs[.]id-ar[.]co num-revs[.]id-ar[.]co num-rev[.]id-ar[.]co\r\nnew[.]id-ar[.]co mail[.]id-ar[.]co join-facetime[.]id-ar[.]co\r\nid-ar[.]co ftp[.]id-ar[.]co abcde-res[.]id-ar[.]co\r\nabc-ninealt[.]id-ar[.]co srv648[.]co-en[.]app srv1[.]srv648[.]co-en[.]app\r\nsignin-id[.]co-en[.]app signin-account[.]co-en[.]app number-ids[.]co-en[.]app\r\nnumber-id[.]co-en[.]app number-appleid[.]co-en[.]app mail[.]srv1[.]srv648[.]co-en[.]app\r\nmail[.]co-en[.]app jd930iojfhis67349x[.]co-en[.]app id[.]co-en[.]app\r\nid-test[.]co-en[.]app ftp[.]co-en[.]app co-en[.]app\r\nres-all[.]en-me[.]cc manage-id[.]en-me[.]cc mail[.]en-me[.]cc\r\njoin-test[.]en-me[.]cc join-facetime[.]en-me[.]cc id[.]en-me[.]cc\r\nicloud[.]en-me[.]cc icaresupport-ap[.]en-me[.]cc ftp[.]en-me[.]cc\r\nft-testt[.]id[.]en-me[.]cc ft-srt-id[.]en-me[.]cc ft-rec-id[.]en-me[.]cc\r\nft-fwa-id[.]en-me[.]cc ft-fce-id[.]en-me[.]cc ft-fac-id[.]en-me[.]cc\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 22 of 26\n\nen-me[.]cc docs-icloudrive-file[.]en-me[.]cc connect-signal[.]en-me[.]cc\r\napg-cps[.]en-me[.]cc update[.]totokapp[.]info yhjdshisdg[.]en-info[.]live\r\nverify-login[.]en-info[.]live totokapp[.]info testh[.]en-info[.]live\r\nshrtstulytdvs[.]en-info[.]live rev-auth-num[.]en-info[.]live mail[.]totokapp[.]info\r\nmail[.]en-info[.]live login-security[.]en-info[.]live htkdfsdf[.]en-info[.]live\r\nen-info[.]live egbfdg545rgdfg[.]en-info[.]live webtest[.]app-care[.]cc\r\nweb[.]app-care[.]cc web-info[.]app-care[.]cc testweb[.]app-care[.]cc\r\ntest[.]web[.]app-care[.]cc test[.]app-care[.]cc page[.]app-care[.]cc\r\nmail[.]app-care[.]cc link[.]app-care[.]cc app-care[.]cc\r\nmsnsge[.]ids-io[.]me mng-ml-bdf-bh[.]ids-io[.]me manage[.]ids-io[.]me\r\nmail[.]ids-io[.]me mail-bdf-bh[.]ids-io[.]me join-facetime[.]ids-io[.]me\r\nids-io[.]me ft-cll-rec[.]ids-io[.]me credentials-checking[.]ids-io[.]me\r\ncloude-manage[.]ids-io[.]me cloud-manage[.]ids-io[.]me zoom-meet[.]me-ar[.]cc\r\nweb-wa[.]me-ar[.]cc uk05web-zoom[.]me-ar[.]cc number[.]me-ar[.]cc\r\nme-ar[.]cc mail[.]me-ar[.]cc join-telegram[.]me-ar[.]cc\r\njoin-facetimes[.]me-ar[.]cc join-facetime[.]me-ar[.]cc facetime-nums[.]me-ar[.]cc\r\nfacetime-num[.]me-ar[.]cc facetime-join[.]me-ar[.]cc appleid-apple[.]me-ar[.]cc\r\naler-new[.]me-ar[.]cc aler-get[.]me-ar[.]cc owa365[.]cc\r\nmail[.]owa365[.]cc mail-bdf-bh[.]owa365[.]cc mng-ma-il[.]owa365[.]cc\r\nverify-icloud[.]en-id[.]net trusted-device-apple[.]en-id[.]net tracking-dhl[.]en-id[.]net\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 23 of 26\n\nsgnl-2fa-manage[.]en-id[.]net mail[.]en-id[.]net join-facetime[.]en-id[.]net\r\nen-id[.]net confirm-your-identity[.]en-id[.]net checkdata[.]en-id[.]net\r\ncall-ft-connect[.]en-id[.]net review-app-id[.]mn-id[.]cc mn-id[.]cc\r\nid-manage[.]mn-id[.]cc ft-rec[.]mn-id[.]cc dpa[.]mn-id[.]cc\r\nc0ac71c4-276f-46a4-a7fe-f062c40b47e6[.]mn-id[.]cc963d2ae3-9d60-4704-8262-\r\n5854b6c02d29[.]mn-id[.]cc\r\n67f34c48-a901-44f1-af9d-81c80b03b5ea[\r\ntkmbijoin-meet[.]mn-id[.]cc sitemaps[.]mn-id[.]cc sitemap[.]mn-id[.]cc\r\nrin-zm[.]mn-id[.]cc resufg-reg[.]mn-id[.]cc mng[.]mn-id[.]cc\r\nmail[.]mn-id[.]cc join-meeting-zm[.]mn-id[.]cc join-facetime[.]mn-id[.]cc\r\nid[.]mng[.]mn-id[.]cc id-mnge[.]mn-id[.]cc gahpkwww[.]join-meet[.]mn-id[.]cc\r\nft-mng[.]mn-id[.]cc dps[.]mn-id[.]cc dos[.]mn-id[.]cc\r\ndfsdfsdgretgf65sdg[.]mn-id[.]cc\r\n4f66072b-2276-4136-acaa-a1a88e294e4f[.]mn-id[.]cc\r\nft-rev[.]mn-id[.]cc\r\nmail[.]ar-id[.]co ar-id[.]co accounts-apple[.]ar-id[.]co\r\nzocp[.]zm-me[.]co test[.]zm-me[.]co signal-connect[.]zm-me[.]co\r\ns-portel[.]zm-me[.]co mail[.]zm-me[.]co join[.]meeting[.]zm-me[.]co\r\nhost[.]zm-me[.]co connect-signal[.]zm-me[.]co telegram[.]com-en[.]io\r\nsecure-signal[.]com-en[.]io numbers[.]com-en[.]io number[.]com-en[.]io\r\nmail[.]com-en[.]io join[.]facetime[.]com-en[.]io join-telegram[.]com-en[.]io\r\njoin-fts[.]com-en[.]io join-ft[.]com-en[.]io join-facetime[.]com-en[.]io\r\nid-apple[.]com-en[.]io facetime[.]com-en[.]io com-en[.]io\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 24 of 26\n\nappleid-apple[.]com-en[.]io alr-res[.]com-en[.]io rec-id-check[.]ar-me[.]co\r\nmngcontrol[.]ar-me[.]co mail[.]ar-me[.]co join-face-time-service[.]ar-me[.]co\r\nid-rec-check[.]ar-me[.]co gsyastf[.]ar-me[.]co d-df-dfd-sddgfssdf[.]ar-me[.]co\r\nauth-privacy[..]ar-me[.]co ar-me[.]co manage[.]ac-im[.]cc\r\nmail[.]ac-im[.]cc facpl[.]ac-im[.]cc fac[.]ac-im[.]cc\r\ncpsl-p[.]ac-im[.]cc ac-im[.]cc 98798hnuyf8diufsd[.]ac-im[.]cc\r\nzo-ref[.]mn-id[.]cc join-meet[.]mn-id[.]cc ft-rev-id[.]en-me[.]cc\r\nft-faw-id[.]en-me[.]cc zoomandfghu3grufe[.]id-ar[.]net verify-isupport[.]id-ar[.]net\r\nus-04web-zoom[.]id-ar[.]net sgnl-link-device[.]id-ar[.]net sgnl-2fa-authenticate[.]id-ar[.]net\r\nmn-rcv-en[.]id-ar[.]net mail[.]id-ar[.]net join-facetime[.]id-ar[.]net\r\nid-ar[.]net icloudrive[.]id-ar[.]net dhl-delivery-address[.]id-ar[.]net\r\ncon[.]call[.]id-ar[.]net call[.]id-ar[.]net call-ft-visual[.]id-ar[.]net\r\nrv-mn-en-infor[.]mation[.]re mail[.]mation[.]re join-facetime[.]infor[.]mation[.]re\r\nft-call-control[.]mation[.]re control-my-data[.]mation[.]re sasaf[.]mation[.]re\r\ninfor[.]mation[.]re idms-rec-infor[.]mation[.]re join-facetime-call-infor[.]mation[.]re\r\nmn-rv-en-infor[.]mation[.]re join-call-facetion-infor[.]mation[.]re verify-infor[.]mation[.]re\r\nmng-rec[.]fullrestores[.]re cdshfis57945tjfkgdfgdf[.]fullrestores[.]re auth-rec-mng[.]fullrestores[.]re\r\nmail[.]fullrestores[.]re join-cll-bot-im[.]fullrestores[.]re fullrestores[.]re\r\nft-cll-2mzkaldlwpfgg[.]fullrestores[.]re mation[.]re cntflksdlkfghdf[.]tication[.]net\r\nuser-verify-authen[.]tication[.]net data-authn[.]tication[.]net join-facetime-call-authen[.]tication[.]net\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 25 of 26\n\ndelivery-verification-authen[.]tication[.]net validate-authn[.]tication[.]net mail[.]tication[.]net\r\ncjtjkj45nkejndfk3j4lkfelfwefwef[.]tication[.]net reutowprueptowue[.]tication[.]net dhl-identity-verification-authen[.]tication[\r\nmc-4kdkf3lflj34lfjlj3l4r34r[.]tication[.]net call-ft-enc-authen[.]tication[.]net verify-mail-authn[.]tication[.]net\r\nid-en[.]io facetime-web[.]id-en[.]io join-facetime[.]id-en[.]io\r\nmail[.]id-en[.]io facetime-webs[.]id-en[.]io alert-new[.]id-en[.]io\r\nauth[.]mailbdf-bh[.]net mail[.]mailbdf-bh[.]net rec-mng[.]mailbdf-bh[.]net\r\nmailbdf-bh[.]net verify-apple[.]com-ae[.]net encryption-plug-in-signal[.]com-ae[.]net\r\njoin-facetime[.]com-ae[.]net com-en-us[.]info com-en-us[.]me\r\nmessage-apple[.]com mail[.]message-apple[.]com ns2[.]com-en-us[.]info\r\njoin-facetime[.]com-en-us[.]info join-zoom[.]com-en-us[.]info login-live[.]com-en-us[.]info\r\naccount-update[.]ar-id[.]co signal-account[.]org en-ir[.]org\r\ntotok-pro[.]ae me-info[.]cc connect-signal[.]me\r\nzm-me[.]co join-meeting[.]zm-me[.]co relaxmode[.]org\r\ntrack-portal[.]co sgnlapp[.]info accountcapabilities-pa[.]google[.]svr-driv\r\nSource: https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nhttps://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire\r\nPage 26 of 26\n\nfacetime-num[.]me-ar[.]cc aler-new[.]me-ar[.]cc facetime-join[.]me-ar[.]cc aler-get[.]me-ar[.]cc appleid-apple[.]me-ar[.]cc owa365[.]cc\nmail[.]owa365[.]cc mail-bdf-bh[.]owa365[.]cc mng-ma-il[.]owa365[.]cc\nverify-icloud[.]en-id[.]net trusted-device-apple[.]en-id[.]net tracking-dhl[.]en-id[.]net\n Page 23 of 26",
	"extraction_quality": 1,
	"language": "NL",
	"sources": [
		"Malpedia"
	],
	"origins": [
		"web"
	],
	"references": [
		"https://www.lookout.com/threat-intelligence/article/bitter-hack-for-hire"
	],
	"report_names": [
		"bitter-hack-for-hire"
	],
	"threat_actors": [],
	"ts_created_at": 1778121804,
	"ts_updated_at": 1778121850,
	"ts_creation_date": 0,
	"ts_modification_date": 0,
	"files": {
		"pdf": "https://archive.orkl.eu/d00ce0cea066e57ec4a1ad5dda1abc535592d7c1.pdf",
		"text": "https://archive.orkl.eu/d00ce0cea066e57ec4a1ad5dda1abc535592d7c1.txt",
		"img": "https://archive.orkl.eu/d00ce0cea066e57ec4a1ad5dda1abc535592d7c1.jpg"
	}
}